0

I'm starting to learn about ModSecurity and rule creation so say I know a page in an web app is vulnerable to cross site scripting.

The rule in question would look something like this:

SecRule ARGS|REQUEST_HEADERS “@rx <script>” id:101,msg: ‘XSS Attack’,severity:ERROR,deny,status:404

Is it possible to create a config file for that particular page (or even wise to do so?) or better said is it possible to create rules for particular URL's?

Improve this question

1 Answer 1

Reset to default
1

Yes it is possible to do so. In mod-security they are having action called chain action like for example,

SecRule REQUEST_URI "/bank/login.aspx" phase:2,chain,t:none,id:105
SecRule &REQUEST_HEADERS:Content-Length "@eq 0" t:none

So you can change your rule accordingly. And google is your best companion for more info.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .